How would an IBM Security QRadar administrator know if asymmetric superflows are enabled?

Question

Options

• AUse the System Notification mechanism (e.g. pop-up)
• BUse the QFlow Collector configuration in the Deployment Editor
• CInvestigate the contents of the BB:AsymmetricSuperFlowSource building block
• DCheck for any log events of the High Level Category Flow and a Low Level Category

• A
  3% (1)
• B
  83% (24)
• C
  10% (3)
• D
  3% (1)

Explanation

Checking asymmetric superflow status is a configuration-level task, which is why you go directly to the QFlow Collector settings inside the Deployment Editor - that interface exposes the collector's properties, including whether asymmetric superflow processing is enabled, making it the authoritative and immediate source.

Why the distractors are wrong:

• A - System Notifications are for runtime alerts and status events, not for inspecting static configuration settings. You wouldn't rely on a pop-up to confirm a feature's enabled state.
• C - BB:AsymmetricSuperFlowSource is a building block used within the rules engine to identify traffic from asymmetric superflow sources; it tells you about matching events, not whether the feature is toggled on at the collector level.
• D - Flow events categorized by High/Low Level Category describe processed network data, not the underlying collector configuration. The presence or absence of certain flow events can be misleading and is not a reliable indicator of the setting.

Memory tip: Think "Deployment Editor = Direct Enabling" - any time you need to verify or change how a QFlow Collector processes data (including superflows), the Deployment Editor is your configuration source of truth.

No community discussion yet for this question.